AU
Vendor
Automattic
143
CVEs
0
On KEV
7
New 30D
Products
JE8.8
Jetpack
Automattic
18 CVEs0 on KEV2 new
SL5.4
Sensei LMS
Automattic
10 CVEs0 on KEV2 new
WO8.8
WooCommerce
automattic
18 CVEs0 on KEV1 new
WO7.1
WordPress
Automattic
4 CVEs0 on KEV1 new
JV6.5
Jetpack VideoPress
Automattic
1 CVEs0 on KEV1 new
AC7.5
Activitypub
Automattic
6 CVEs0 on KEV0 new
WS9.8
WP Super Cache
Automattic
6 CVEs0 on KEV0 new
JC8.8
Jetpack CRM
Automattic
5 CVEs0 on KEV0 new
NN9.9
Newspack Newsletters
Automattic
5 CVEs0 on KEV0 new
WO9.8
Woopayments
Automattic
5 CVEs0 on KEV0 new
CD8.8
Crowdsignal Dashboard
Automattic
4 CVEs0 on KEV0 new
NB9.9
Newspack Blocks
Automattic
4 CVEs0 on KEV0 new
WF9.8
WooPayments – Fully Integrated Solution Built and Supported by Woo
Automattic
4 CVEs0 on KEV0 new
WJ5.4
WP Job Manager
Automattic
4 CVEs0 on KEV0 new
MA6.1
Mailpoet
Automattic
3 CVEs0 on KEV0 new
MO9.1
mongoose
Automattic
3 CVEs0 on KEV0 new
CE7.5
Camptix Event Ticketing
Automattic
2 CVEs0 on KEV0 new
JB9.1
Jetpack Boost
Automattic
2 CVEs0 on KEV0 new
JW5.4
Jetpack – WP Security, Backup, Speed, & Growth
automattic
2 CVEs0 on KEV0 new
VA9.8
Vaultpress
Automattic
2 CVEs0 on KEV0 new
WB7.5
WooCommerce Blocks
Automattic
2 CVEs0 on KEV0 new
WB8.8
Woocommerce Bookings
Automattic
2 CVEs0 on KEV0 new
WJ4.3
WP Job Manager - Resume Manager
Automattic
2 CVEs0 on KEV0 new
AK6.1
Akismet
Automattic
1 CVEs0 on KEV0 new
AU9.8
automattic/mongoose
automattic
1 CVEs0 on KEV0 new
CP8.8
Canada Post Shipping Method
Automattic
1 CVEs0 on KEV0 new
CA8.8
Canvas
Automattic
1 CVEs0 on KEV0 new
CH6.5
ChaosTheory
Automattic
1 CVEs0 on KEV0 new
CD4.3
Crowdsignal Dashboard – Polls, Surveys & more
Automattic
1 CVEs0 on KEV0 new
CF3.8
Crowdsignal Forms
Automattic
1 CVEs0 on KEV0 new
DE4.3
Developer
Automattic
1 CVEs0 on KEV0 new
GE–
Genericons
Automattic
1 CVEs0 on KEV0 new
GH5.4
Ghacitivity
Automattic
1 CVEs0 on KEV0 new
GH5.4
GHActivity
Automattic
1 CVEs0 on KEV0 new
JC8.8
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
automattic
1 CVEs0 on KEV0 new
JD5.3
Jetpack Debug Tools
Automattic
1 CVEs0 on KEV0 new
LL6.1
Limit Login Attempts
automattic
1 CVEs0 on KEV0 new
NE8.8
Newspack
Automattic
1 CVEs0 on KEV0 new
NA5.4
Newspack Ads
Automattic
1 CVEs0 on KEV0 new
NC5.4
Newspack Campaigns
Automattic
1 CVEs0 on KEV0 new
NC6.5
Newspack Content Converter
Automattic
1 CVEs0 on KEV0 new
NP5.4
Newspack Popups
Automattic
1 CVEs0 on KEV0 new
SL5.4
Sensei LMS – Online Courses, Quizzes, & Learning
Automattic
1 CVEs0 on KEV0 new
SP5.3
Sensei Pro
Automattic
1 CVEs0 on KEV0 new
SP5.3
Sensei Pro (WC Paid Courses)
Automattic
1 CVEs0 on KEV0 new
WS8.8
W3 Super Cache
Automattic
1 CVEs0 on KEV0 new
WG7.5
Woocommerce Gocardless
Automattic
1 CVEs0 on KEV0 new
WP9.8
Woocommerce Payments
Automattic
1 CVEs0 on KEV0 new
WS8.1
Woocommerce Square
Automattic
1 CVEs0 on KEV0 new
WS9.8
Woocommerce Stripe
Automattic
1 CVEs0 on KEV0 new
WS7.5
Woocommerce Subscriptions
Automattic
1 CVEs0 on KEV0 new
WE5.4
WordPress.com Editing Toolkit
Automattic
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112329 | SL Sensei LMS Automattic | 4.3 | Oct 19 | Sensei LMS 4.26.4 Broken Access Control via save_new_message |
| CVE-2026-112328 | SL Sensei LMS Automattic | 4.3 | Oct 19 | Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX |
| CVE-2026-40808 | JV Jetpack VideoPress Automattic | 6.5 | Oct 10 | WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability |
| CVE-2026-106608 | WO WooCommerce Automattic | 7.2 | Oct 10 | WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability |
| CVE-2026-106601 | JE Jetpack Automattic | 5.4 | Oct 9 | WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability |
| CVE-2026-106602 | JE Jetpack Automattic | 4.8 | Oct 9 | WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability |
| CVE-2026-66666 | WO WordPress Automattic | 6.9 | Oct 6 | WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability |
| CVE-2026-93485 | WO WordPress Automattic | 7.1 | Sep 18 | WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-48888 | WO WooCommerce Automattic | 7.5 | Sep 8 | WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability |
| CVE-2026-57777 | WO WooCommerce Automattic | 7.6 | Sep 4 | WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability |
| CVE-2026-73562 | MO mongoose Automattic | 6.5 | Aug 13 | Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) |
| CVE-2026-42334 | MO mongoose Automattic | 7.5 | May 14 | Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection |
| CVE-2026-4338 | AC Activitypub Automattic | 7.5 | Apr 8 | ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure |
| CVE-2026-3589 | WO WooCommerce Automattic | 7.5 | Mar 6 | WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF |
| CVE-2026-22356 | JC Jetpack CRM Automattic | 7.5 | Feb 20 | WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability |
| CVE-2026-25404 | WJ WP Job Manager Automattic | 5.3 | Feb 19 | WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability |
| CVE-2023-54332 | JE Jetpack Automattic | 6.1 | Jan 13 | Jetpack 11.4 - Cross Site Scripting (XSS) |
| CVE-2023-52212 | WJ WP Job Manager Automattic | 5.4 | Jan 5 | WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2025-69015 | CF Crowdsignal Forms Automattic | 3.8 | Dec 30 | WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability |
| CVE-2025-15033 | WO WooCommerce Automattic | 6.5 | Dec 22 | WooCommerce - Subscriber/Customer+ Order Data Disclosure |
| CVE-2023-7320 | WO WooCommerce automattic | 5.3 | Oct 29 | WooCommerce <= 7.8.2 - Sensitive Information Exposure |
| CVE-2025-49042 | WO WooCommerce Automattic | 5.9 | Oct 29 | WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-57924 | DE Developer Automattic | 4.3 | Sep 22 | WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability |
| CVE-2025-49325 | NN Newspack Newsletters Automattic | 4.7 | Jun 6 | WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability |
| CVE-2025-5062 | WO WooCommerce automattic | 6.1 | May 22 | WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting |
| CVE-2024-8009 | SL Sensei Lms Automattic | 4.3 | May 15 | Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure |
| CVE-2024-6584 | JB Jetpack Boost Automattic | 9.1 | May 15 | Jetpack Boost < 3.4.7 - Admin+ SSRF |
| CVE-2024-12743 | MA Mailpoet Automattic | 4.8 | May 15 | MailPoet < 5.5.2 - Admin+ Stored XSS |
| CVE-2024-10076 | JB Jetpack Boost Automattic | 5.9 | May 15 | Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS |
| CVE-2024-10075 | JE Jetpack Automattic | 5.6 | May 15 | Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution |
| CVE-2024-56006 | JD Jetpack Debug Tools Automattic | 5.3 | May 15 | WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability |
| CVE-2025-22740 | SL Sensei LMS Automattic | 5.3 | Mar 27 | WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerability |
| CVE-2025-26762 | WO WooCommerce Automattic | 5.9 | Mar 27 | WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-0466 | SL Sensei Lms Automattic | 5.3 | Feb 4 | Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure |
| CVE-2024-37241 | WJ WP Job Manager - Resume Manager Automattic | 4.3 | Jan 2 | WordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-37242 | NN Newspack Newsletters Automattic | 4.3 | Jan 2 | WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-10858 | JE Jetpack Automattic | 6.1 | Dec 25 | Jetpack 13.0-14.0 - Unauthenticated DOM-XSS |
| CVE-2024-53900 | MO Mongoose Automattic | 9.1 | Dec 2 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection |
| CVE-2024-43338 | CD Crowdsignal Dashboard – Polls, Surveys & more Automattic | 4.3 | Nov 19 | WordPress Crowdsignal Polls & Ratings plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-10103 | MA Mailpoet Automattic | 6.1 | Nov 19 | MailPoet < 5.3.2 - Admin+ Stored XSS |
| CVE-2024-10486 | WO Woocommerce Automattic | 5.3 | Nov 18 | Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File |
| CVE-2024-9926 | JE Jetpack Automattic | 4.3 | Nov 7 | Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access |
| CVE-2024-37423 | NB Newspack Blocks Automattic | 8.5 | Nov 1 | WordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability |
| CVE-2024-37425 | NB Newspack Blocks Automattic | 5.4 | Nov 1 | WordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerability |
| CVE-2024-37443 | WJ WP Job Manager - Resume Manager Automattic | 4.3 | Nov 1 | WordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerability |
| CVE-2024-37475 | NN Newspack Newsletters Automattic | 5.3 | Nov 1 | WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerability |
| CVE-2024-37477 | NC Newspack Content Converter Automattic | 6.5 | Nov 1 | WordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerability |
| CVE-2024-43968 | NE Newspack Automattic | 8.8 | Nov 1 | WordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerability |
| CVE-2024-9944 | WO WooCommerce automattic | 6.1 | Oct 15 | WooCommerce <= 9.0.2 - Unauthenticated HTML Injection |
| CVE-2024-7786 | SL Sensei Lms Automattic | 5.3 | Sep 4 | Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak |
| CVE-2024-43949 | GH GHActivity Automattic | 5.4 | Aug 29 | WordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-35686 | SL Sensei LMS Automattic | 5.3 | Aug 18 | WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability |
| CVE-2024-39666 | WO WooCommerce Automattic | 5.9 | Aug 18 | WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-37115 | NB Newspack Blocks Automattic | 7.5 | Jul 10 | WordPress Newspack Blocks plugin <= 3.0.8 - Sensitive Data Exposure vulnerability |
| CVE-2024-37424 | NB Newspack Blocks Automattic | 9.9 | Jul 9 | WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability |
| CVE-2024-35777 | WO WooCommerce Automattic | 3.5 | Jul 9 | WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability |
| CVE-2024-37474 | NA Newspack Ads Automattic | 5.4 | Jul 4 | WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-37476 | NC Newspack Campaigns Automattic | 5.4 | Jul 4 | WordPress Newspack Campaigns plugin <= 2.31.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-32111 | WO WordPress Automattic | 5.0 | Jun 25 | WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability |
| CVE-2024-31111 | WO WordPress Automattic | 6.5 | Jun 25 | WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability |